Analysis

  • max time kernel
    87s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    10-09-2021 15:37

General

  • Target

    6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb.exe

  • Size

    4.0MB

  • MD5

    9cadcadb612787dc6c2e9901ffe49dec

  • SHA1

    dfaeffadd7767ea23cabc31a59ae2cd461abf00f

  • SHA256

    6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb

  • SHA512

    e7d908a73e85965359169b9d3e14ec3f1f81218354aa09a8d6c027be230e30c4f334122b933579ce6ad35e5eaffc01c6d8124e5f1a11671b7f6b36549d55beff

Malware Config

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb.exe
    "C:\Users\Admin\AppData\Local\Temp\6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4796
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rlmeisxk\rlmeisxk.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7F7.tmp" "c:\Users\Admin\AppData\Local\Temp\rlmeisxk\CSC4A66E73C306D4AD9B2C12ABD8513448.TMP"
          4⤵
            PID:5012
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1836
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3336
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2652
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:4440
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:3056
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:4220
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4596
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:2824
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2628
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4136
                  • C:\Windows\SysWOW64\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3636
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:648
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1016
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4636
                    • C:\Windows\SysWOW64\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4376
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:3932
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:5032
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:5036

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                    MD5

                    f3068198b62b4b70404ec46694d632be

                    SHA1

                    7b0b31ae227cf2a78cb751573a9d07f755104ea0

                    SHA256

                    bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8

                    SHA512

                    ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

                  • C:\Users\Admin\AppData\Local\Temp\RESF7F7.tmp

                    MD5

                    74b775dde5b64a7073a63fba3710daf7

                    SHA1

                    0cbde7105a33057d98c757ec2889060f42dc20b9

                    SHA256

                    e1068b626c575132b600f0ff37d184c1e66eced103e5fa000c8699a5d21fa3d3

                    SHA512

                    593361c6424364475d1845efaf0ef5a9e63c0c874bf2de598877587c32b1743f49810a5668ecabe747bbd9c169df2d28054a9802766fe1ade65df9391bb4c773

                  • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                    MD5

                    30303b0cc1d6833b7dc84fbb907822be

                    SHA1

                    caaa99bb9a56a6974ba16fce6e01f4f95016b9f5

                    SHA256

                    91b6b2284e42eb7bdf6371fcbaf1724027fc600cd9bb56ed81f2f7d8c784f617

                    SHA512

                    117cb2e2c687d2cca1c069151df4c085dcb4a88e51b1f17b8b0e2f9ce1adf181ed76b8cc1c262bee45e34d7a8b513d5bf19a50f394064cf5c132fec23a6fb7da

                  • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                    MD5

                    28d9755addec05c0b24cca50dfe3a92b

                    SHA1

                    7d3156f11c7a7fb60d29809caf93101de2681aa3

                    SHA256

                    abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                    SHA512

                    891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                  • C:\Users\Admin\AppData\Local\Temp\rlmeisxk\rlmeisxk.dll

                    MD5

                    f3a97dfa37559f866f4642a4334fb6a3

                    SHA1

                    24887b46412ae12ba79a904dce03fc2f3227da8b

                    SHA256

                    61b59c8db4f80ad053d17cf3a12de540fbe26bcbbac52526e271eaccf8abac19

                    SHA512

                    b897e95feb66819c7543a94a6e8cd79c24bf9db252935edba2be0090d159b2dc44d4f07ed79db50cdfb9ebeb7b5c6726680e245cfc00de4504d70dd237f73c1f

                  • \??\c:\Users\Admin\AppData\Local\Temp\rlmeisxk\CSC4A66E73C306D4AD9B2C12ABD8513448.TMP

                    MD5

                    c38dfb364176fbc3900dc74e060b3d59

                    SHA1

                    65e77d4a5cad3daefeb7bfadef1f7f7b41c60fbb

                    SHA256

                    765e9d00180d92f7cab7f9f61ecef00b61346875831ec208c3fa96de10e1d4f7

                    SHA512

                    5671ab9d2a78a494f8c878e3014ccb0cb80c72893322cbd7d27f55106f1bceab4feedbfe918e6de33d46726fd741569b0694f8320209de97d76aa6ffcd338a5a

                  • \??\c:\Users\Admin\AppData\Local\Temp\rlmeisxk\rlmeisxk.0.cs

                    MD5

                    9f8ab7eb0ab21443a2fe06dab341510e

                    SHA1

                    2b88b3116a79e48bab7114e18c9b9674e8a52165

                    SHA256

                    e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                    SHA512

                    53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                  • \??\c:\Users\Admin\AppData\Local\Temp\rlmeisxk\rlmeisxk.cmdline

                    MD5

                    e27f848a662a392c72a76b090be8846d

                    SHA1

                    ccfc9b963da1c36e00756123ea8a78c84215ebb9

                    SHA256

                    7d3c4bcf16a95172c96964deb50c25473665b713980bb5baa999e3f1d0cb819d

                    SHA512

                    746ccaa59dbdd0606d8c46cf438f4c5f405eaccc5ca611efca9f597c7b191ded79d1755e673cc923524f89174ee5a6d5b259e28ce6dc168bf605e9e879c28b28

                  • memory/648-1008-0x0000000000000000-mapping.dmp

                  • memory/1016-1009-0x0000000000000000-mapping.dmp

                  • memory/1836-412-0x0000000008EE0000-0x0000000008EE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1836-198-0x0000000008CE0000-0x0000000008D13000-memory.dmp

                    Filesize

                    204KB

                  • memory/1836-186-0x0000000004D40000-0x0000000004D41000-memory.dmp

                    Filesize

                    4KB

                  • memory/1836-187-0x0000000004D42000-0x0000000004D43000-memory.dmp

                    Filesize

                    4KB

                  • memory/1836-177-0x0000000000000000-mapping.dmp

                  • memory/1836-206-0x0000000008CC0000-0x0000000008CC1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1836-207-0x000000007EBD0000-0x000000007EBD1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1836-212-0x0000000008E10000-0x0000000008E11000-memory.dmp

                    Filesize

                    4KB

                  • memory/1836-213-0x0000000008FE0000-0x0000000008FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1836-406-0x0000000008EF0000-0x0000000008EF1000-memory.dmp

                    Filesize

                    4KB

                  • memory/2628-1005-0x0000000000000000-mapping.dmp

                  • memory/2652-697-0x0000000004F72000-0x0000000004F73000-memory.dmp

                    Filesize

                    4KB

                  • memory/2652-792-0x000000007FA90000-0x000000007FA91000-memory.dmp

                    Filesize

                    4KB

                  • memory/2652-696-0x0000000004F70000-0x0000000004F71000-memory.dmp

                    Filesize

                    4KB

                  • memory/2652-683-0x0000000000000000-mapping.dmp

                  • memory/2824-1002-0x0000000000000000-mapping.dmp

                  • memory/3056-963-0x0000000000000000-mapping.dmp

                  • memory/3336-432-0x0000000000000000-mapping.dmp

                  • memory/3336-467-0x000000007EAF0000-0x000000007EAF1000-memory.dmp

                    Filesize

                    4KB

                  • memory/3336-442-0x00000000071E2000-0x00000000071E3000-memory.dmp

                    Filesize

                    4KB

                  • memory/3336-441-0x00000000071E0000-0x00000000071E1000-memory.dmp

                    Filesize

                    4KB

                  • memory/3636-1007-0x0000000000000000-mapping.dmp

                  • memory/3932-1012-0x0000000000000000-mapping.dmp

                  • memory/4136-1006-0x0000000000000000-mapping.dmp

                  • memory/4220-964-0x0000000000000000-mapping.dmp

                  • memory/4376-1011-0x0000000000000000-mapping.dmp

                  • memory/4440-962-0x0000000000000000-mapping.dmp

                  • memory/4596-1001-0x0000000000000000-mapping.dmp

                  • memory/4636-1010-0x0000000000000000-mapping.dmp

                  • memory/4684-120-0x0000000005862000-0x0000000005863000-memory.dmp

                    Filesize

                    4KB

                  • memory/4684-115-0x0000000005C80000-0x000000000607F000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4684-123-0x0000000008650000-0x0000000008651000-memory.dmp

                    Filesize

                    4KB

                  • memory/4684-122-0x00000000061A0000-0x00000000061A1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4684-121-0x0000000005863000-0x0000000005864000-memory.dmp

                    Filesize

                    4KB

                  • memory/4684-117-0x0000000006580000-0x0000000006581000-memory.dmp

                    Filesize

                    4KB

                  • memory/4684-118-0x0000000006220000-0x0000000006221000-memory.dmp

                    Filesize

                    4KB

                  • memory/4684-119-0x0000000005860000-0x0000000005861000-memory.dmp

                    Filesize

                    4KB

                  • memory/4684-124-0x0000000005864000-0x0000000005865000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-134-0x00000000080F0000-0x00000000080F1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-138-0x0000000008A10000-0x0000000008A11000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-153-0x0000000009790000-0x0000000009791000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-131-0x0000000007FF0000-0x0000000007FF1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-136-0x00000000051D0000-0x00000000051D1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-125-0x0000000000000000-mapping.dmp

                  • memory/4796-137-0x00000000051D2000-0x00000000051D3000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-145-0x0000000009700000-0x0000000009701000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-128-0x0000000005220000-0x0000000005221000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-1126-0x000000007EF40000-0x000000007EF41000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-155-0x00000000051D3000-0x00000000051D4000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-135-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-144-0x0000000009E30000-0x0000000009E31000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-176-0x0000000009B00000-0x0000000009B01000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-133-0x00000000082C0000-0x00000000082C1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-129-0x0000000007920000-0x0000000007921000-memory.dmp

                    Filesize

                    4KB

                  • memory/4796-130-0x0000000007F50000-0x0000000007F51000-memory.dmp

                    Filesize

                    4KB

                  • memory/4984-146-0x0000000000000000-mapping.dmp

                  • memory/5012-149-0x0000000000000000-mapping.dmp

                  • memory/5032-1025-0x0000000000000000-mapping.dmp

                  • memory/5036-1026-0x0000000000000000-mapping.dmp